PortalFuse Quarterly Security Report

The "Quarterly CVE Landscape" section provides a foundational, data-driven analysis of all Common Vulnerabilities and Exposures (CVEs) affecting Windows and Edge products disclosed between April 1 and June 30, 2025. Its objective is to quantify the total volume of vulnerabilities, their severity distribution, and their categorical breakdown. For system administrators and security leadership, these metrics offer a crucial baseline for gauging the scale of required vulnerability management efforts, identifying strategic trends, and allocating resources effectively against the most significant threats addressed by Microsoft this quarter.

During the reporting period, a total of 249 CVEs were analyzed. This volume represents a significant, albeit reduced, set of challenges for enterprise security teams. The subsequent analysis dissects this total, examining the monthly disclosure cadence, the severity profile of the vulnerabilities, and the specific types of threats they represent, establishing the essential context for the deeper technical assessments that follow in this report.

An analysis of the monthly disclosure trends, illustrated in Figure 1, reveals a heavily front-loaded quarter. Activity peaked in April with 93 new and 43 updated CVEs, marking it as the most volatile month. This initial surge was followed by a significant decline across May and June. By June, updated CVEs fell to just a single instance against 52 new entries. This pattern highlights a consistent influx of novel vulnerabilities and suggests that workloads for vulnerability triage and remediation were most intense at the start of the quarter.

The severity profile for this quarter, depicted in Figure 2, was unequivocally dominated by high-severity vulnerabilities. This classification far outpaced all others, peaking in April with 103 instances before declining to 31 in May and 25 in June. Medium-severity CVEs represented a consistent secondary factor, with counts of 28, 26, and 24 over the three months, indicating a steady stream of moderate-risk issues requiring attention.

In stark contrast to the prevalence of high-severity issues, critical-severity vulnerabilities were nearly nonexistent, with only a single case recorded in May. Low-severity vulnerabilities were similarly marginal, with only two instances appearing in June. Despite the scarcity of critical-level threats, the combined weight of critical and high-severity findings constituted 64.3% of all reported CVEs, reinforcing the strategic necessity of prioritizing response efforts on issues carrying the greatest potential impact.

The quarter's overall median CVSS score registered at 7.5, a figure that reinforces the predominance of vulnerabilities with meaningful risk profiles. While this is slightly lower than the preceding period, a median score in the 'High' severity range indicates that, on average, the vulnerabilities disclosed require timely and methodical remediation to mitigate substantial security risks.

Examining the specific nature of the threats, the landscape was primarily defined by three key categories. As detailed in Figure 3, these top-tier threats collectively account for over two-thirds of all reported issues, underscoring a concentrated adversary focus on specific attack vectors. The most prominent of these was Privilege Elevation, followed by Remote Code Execution and Information Disclosure.

Privilege Elevation vulnerabilities emerged as the single largest category, with 81 CVEs representing 32.5%—nearly one-third—of all disclosures. This pronounced dominance signals a persistent and significant threat vector aimed at compromising privilege boundaries within enterprise environments. The sustained focus on exploiting authentication, authorization, and permission models highlights a critical area of ongoing risk for identity and endpoint security.

A quarter-over-quarter comparison reveals a significant contraction in both risk and volume. The total CVE count fell by 36.5% (143 fewer CVEs), and the combined share of high and critical-severity vulnerabilities decreased by 6.4 percentage points. The near-elimination of critical-severity issues—dropping from nine last quarter to just one—and the slight reduction in the median CVSS score from 7.8 to 7.5 suggest a modest easing of the overall risk profile for Windows and Edge deployments.

This quarter’s overwhelming dominance of Privilege Elevation vulnerabilities, representing nearly a third of all CVEs, signals a fundamental and persistent threat vector that transcends routine patching. This trend directly undermines core security pillars, from centralized identity frameworks like Microsoft Entra to the integrity of remote and operational endpoints. It serves as a critical reminder that perimeter defenses alone are insufficient. The data compels a strategic shift toward robust internal privilege management, continuous monitoring of escalation pathways, and proactive identity protection to effectively counter the risk of lateral movement and prevent widespread enterprise compromise.

The Q2 2025 CVE landscape is defined by a marked reduction in vulnerability volume and top-tier severity. However, high-severity issues remain the predominant challenge, with Privilege Elevation, Remote Code Execution, and Information Disclosure constituting the core of the threat profile. The data indicates that Windows 11 24h2 x64-based systems were the most frequently affected product segment, highlighting the need for focused attention on these platforms. This foundational analysis equips security teams with a precise, strategic understanding of the primary challenges and trends from the past quarter, setting the stage for the granular deep dives that follow.

The "Attack Surface Analysis: Exploitability & Access" section moves beyond theoretical severity to dissect the practical, real-world exploitability of this quarter's vulnerabilities. To truly understand operational risk, security teams must analyze the specific pathways an adversary could leverage. This analysis equips administrators to transition from a reactive to a proactive security posture by illuminating the most probable and impactful threats, distinguishing, for example, a network-based, no-privilege exploit from one requiring local access and user complicity.

To achieve this, our analysis interrogates four key dimensions of exploitability. This framework is designed to help technical leaders and engineers expertly prioritize remediation efforts by focusing on the characteristics that make a vulnerability most dangerous in a live environment. Understanding these factors is the key to moving beyond simple CVSS scores and toward a truly risk-informed security strategy.

Attack Vector: This dimension identifies the pathway through which a vulnerability can be exploited, such as the Network, Adjacent Network, Local, or Physical. A Network vector is typically the most critical, as it indicates a vulnerability can be attacked remotely over the internet, dramatically expanding the pool of potential attackers and requiring no prior access to the target's local environment.

Privileges Required: This metric specifies the level of system access an attacker must possess before they can exploit the vulnerability (None, Low, or High). Vulnerabilities requiring 'None' are exceptionally dangerous because they represent an unauthenticated attack surface, meaning an adversary needs no credentials or prior foothold to launch an attack.

User Interaction: This factor determines whether a legitimate user must take an action, such as clicking a link or opening a malicious file ('Required'), for the exploit to succeed. Vulnerabilities that require 'None' are of higher concern because they can often be automated and spread without human intervention, sometimes leading to wormable threats.

Attack Complexity: This dimension assesses the operational difficulty of an exploit, considering conditions beyond the attacker's control ('Low' or 'High'). A 'Low' complexity rating signifies that an attacker can expect repeatable success against any vulnerable target, indicating fewer hurdles and making the vulnerability ripe for widespread, opportunistic exploitation.

By examining these factors in combination, we can construct a nuanced, multi-dimensional view of risk. The following analysis will now proceed to apply this framework to the quarter's data, starting with the foundational distribution of attack vectors and building toward a synthesized, operational picture of the threat landscape.

Analysis of attack vectors, shown in Figure 4, reveals that the threat landscape is dominated by remote and local access pathways. Network-based vectors lead with 49.8% of all CVEs, followed closely by Local vectors at 44.6%. Together, these constitute over 94% of the total, indicating that the vast majority of vulnerabilities are accessible without physical proximity. The prevalence of Network vectors, in particular, signals broad exposure to remote exploitation, bypassing geographical or environmental constraints.

Figure 5 deepens this analysis by cross-tabulating exploit pathways with the access an attacker must possess beforehand. A critical pattern emerges: the Network vector overwhelmingly pairs with "No Privileges," representing 103 out of 124 cases. This finding underscores a severe operational concern, as it confirms that most remotely exploitable vulnerabilities are accessible to unauthenticated attackers, dramatically amplifying their potential reach and impact.

Conversely, vulnerabilities requiring a Local attack vector predominantly necessitate Low Privileges (83 cases), with a smaller subset needing no prior access (22 cases). While this implies an attacker must first gain a foothold on the system, the data also suggests that once this minimal access is achieved, a wide array of privilege escalation pathways becomes available, making initial compromise a critical pivot point for broader attacks.

Further granularity emerges when cross-referencing vulnerability categories with their exploitability prerequisites, as shown in Figure 6. Remote Code Execution (RCE) vulnerabilities are almost universally Network-based and require No Privileges (32 cases), presenting a formidable challenge for defenders. Similarly, Denial of Service CVEs cluster strongly in the Network/No Privileges quadrant (15 cases). This concentration highlights specific vulnerability types that expose perimeter systems to immediate, unauthenticated threats.

Figure 7 adds another layer of operational nuance by examining user interaction and attack complexity. Within the critical Privilege Elevation category, a majority of vulnerabilities (48 cases) are characterized by low complexity and require no user action, making them dangerously efficient once an attacker has local access. RCEs, in contrast, frequently depend on user interaction (27 cases), suggesting that phishing and social engineering remain key enablers for this attack class. Across all categories, low-complexity vulnerabilities vastly outnumber high-complexity ones, indicating that for most high-impact threats, the barriers to exploitation remain minimal.

This quarter's attack surface is defined by two critical and distinct threat vectors. First, the predominance of low-complexity, no-privilege Network vulnerabilities exposes perimeter defenses like Microsoft Entra and Defender to immediate, unauthenticated compromise. Second, the high volume of Local privilege elevation vulnerabilities requiring only minimal user-level access creates a significant risk of post-compromise escalation. This dual threat demands a defense-in-depth strategy: while rigorous patching of the perimeter is essential, it must be complemented by stringent internal least-privilege enforcement and continuous monitoring to prevent any initial foothold from cascading into full administrative control.

Figure 8 synthesizes these dimensions into a unified operational risk model. Each point represents a CVE, plotted by a composite risk score, with bubble size and proximity to the center indicating higher CVSS scores. The chart reveals a dense clustering of vulnerabilities in the Low and Medium risk rings, with the 7.0–7.8 CVSS range being particularly populated. The High and Critical rings are sparse, but their occupants represent significant, high-impact threats, confirming a strong alignment between technical exploitability and assigned severity.

A crucial insight is provided by isolating the "worst-case" CVEs: those that are Network-based, require no privileges, demand no user interaction, and have low attack complexity. This quarter, nine such vulnerabilities were identified, a sharp increase from zero in the previous period. This nontrivial count signifies a distinct and elevated risk, as these CVEs expose organizations to immediate, remote, and potentially devastating attacks that require no user mistake or prior compromise.

Simultaneously, the high concentration of local privilege elevation vulnerabilities that leverage minimal pre-existing access underscores an enduring threat vector for adversaries who achieve even a basic system foothold. For system engineers, the clear implication is that operational risk is overwhelmingly driven by the intersection of remote attack vectors and minimal access requirements. This necessitates a continuous reassessment of remediation priorities, focusing on the vulnerabilities that offer attackers the most direct and unimpeded path to compromise.

This quarter's attack surface is defined by a landscape where theoretical severity is matched by practical exploitability. The data reveals a persistent threat from low-complexity, no-privilege, network-exploitable vulnerabilities that dramatically expand an attacker's reach, particularly against perimeter systems like Microsoft Entra and Defender. This reality demands vigilant, risk-driven prioritization and a security posture that accounts for broad accessibility and ease of exploitation.

In the "Deep Dive: CVSS Insights & Prioritization Hotspots" section, we shift our focus from the pathways of exploitation to the intrinsic severity and root causes of this quarter's vulnerabilities. While understanding the attack surface is crucial, a comprehensive risk assessment also requires dissecting the Common Vulnerability Scoring System (CVSS) scores and their distribution. A high average severity score can be misleading if it masks a wide variance; conversely, a category with a narrow range of consistently high scores signals a uniformly dangerous group of vulnerabilities.

Furthermore, this analysis drills down into the underlying software flaws by examining the most frequent Common Weakness Enumerations (CWEs). Identifying recurring CWEs is fundamental to proactive defense. It moves the focus from patching individual vulnerabilities to addressing systemic weaknesses in code and architecture, ultimately preventing future issues.

By exploring CVSS score distributions and spotlighting prevalent CWEs, this deep dive provides technical teams with the nuanced data needed for sharp risk prioritization and strategic defense planning.

This quarter’s review of CVSS base score distributions reveals that Remote Code Execution (RCE) vulnerabilities dominate both in terms of frequency and intrinsic severity. Figure 9, which presents the CVSS score distribution by category, uses a boxplot format to visually summarize these metrics for each major vulnerability class. In a boxplot, the central box captures the interquartile range (IQR)—the middle 50% of CVSS scores—while the line inside marks the median, and the whiskers extend to the minimum and maximum observed values. This enables a rapid assessment of both the central tendency and the degree of variability within each category.

Analysis of the RCE category demonstrates a distinctly severe and uniform risk profile. The median CVSS score for RCEs remains at a critical 8.8, with the bulk of scores closely clustered between approximately 7.8 and 8.8, reflecting a narrow IQR. This tightly bunched and high-scoring pattern indicates that nearly all RCE vulnerabilities this quarter are not only severe but also remarkably consistent in their potential impact—a finding reinforced by an overall 90th percentile (P90) CVSS of 8.8. Such uniformity minimizes ambiguity in prioritization: nearly every RCE identified represents an acute threat requiring heightened attention.

By contrast, other vulnerability categories display more variable risk profiles. Security Feature Bypass vulnerabilities, for instance, exhibit the widest spread in CVSS base scores, with values ranging from roughly 5.4 up to 8.6. This broad IQR signifies that while some feature bypass issues are of moderate concern, others reach high or even critical severity, necessitating detailed scrutiny on a case-by-case basis. Similarly, Information Disclosure vulnerabilities are generally of lower intrinsic severity (with most scores near 5.5–6.5), yet the presence of several high-end outliers—including those peaking at 8.8—signals sporadic, but significant, escalation risk within this category.

Turning to root causes, the quarter's CVE sample continues to demonstrate a marked concentration of high-severity flaws in a limited set of Common Weakness Enumerations (CWEs). Specifically, CWE-416 (Use After Free) and CWE-125 (Out-of-bounds Read) emerge as the most prevalent within high and critical CVEs, each with 34 documented instances. These two memory safety weaknesses collectively account for a substantially higher share of vulnerabilities than the third leading weakness, CWE-122 (Heap-based Buffer Overflow), which appears 28 times. The cumulative coverage of the top three CWEs reaches 59.6% this quarter—an increase of 11.3 percentage points (a 23.4% relative jump) compared to last quarter. This demonstrates a growing concentration of exploits leveraging a small set of systemic weaknesses, overwhelmingly in memory handling.

A more granular view is provided by Figure 10, which shows the CVSS distribution by attack vector for the top CWEs. Each panel of this visualization isolates a specific high-frequency CWE and presents the spread of severity (as measured by CVSS) depending upon the attack vector—most commonly, Network or Local. For instance, RCEs that exploit CWE-416 (Use After Free) over the network consistently present very high CVSS scores—predominantly at 8.8 and above—indicating robust exploitation potential regardless of implementation context. Local attack vector variants of CWE-416, while still severe (often scoring 7.8), exhibit slightly greater variability and do not consistently reach the critical threshold. This trend underscores the acute danger posed by remotely exploitable memory corruption bugs, cementing their place as top prioritization candidates for security operations.

Examining CWE-125 (Out-of-bounds Read), a similar but subtly distinct pattern arises. Network-exploitable variants show CVSS scores that swing from moderate (6.5) for pure disclosure scenarios, up to critical (8.8) where remote code execution or privilege escalation is feasible. Conversely, many local exposures of CWE-125 remain in the moderate-severity band (5.5–7.8), further accentuating the heightened risk that comes when these weaknesses are accessible over the network. This stratification, visible in the composite chart, exemplifies why both the type of flaw and its exploit context are essential for effective risk discrimination.

Beyond the top two, CWE-122 (Heap-based Buffer Overflow) displays consistently high CVSS scores—frequently reaching the 8.8 mark, especially when remotely exploitable. This echoes the broader pattern among memory safety defects: when these flaws can be exploited remotely, they represent some of the most damaging and repeatable threats in the Microsoft technology stack. The remaining top CWEs—such as CWE-20 (Improper Input Validation) and CWE-591 (Sensitive Data Storage in Improperly Protected Location)—are markedly less frequent and generally exhibit greater variance across attack vectors and severities, highlighting the outsized role of the primary three weaknesses.

In aggregate, memory safety remains the predominate systemic risk vector within Microsoft CVEs this quarter. Of all classified weaknesses, 120 are attributed to the memory safety category, with minimal representation from other classes such as improper access control or input validation/injection. Although the absolute count of memory safety bugs has declined since last quarter (down 31.0%), their relative contribution to critical and high-risk CVEs remains pronounced, as evinced by the top three CWEs’ expanded share.

Notably, no new CWE types emerged this quarter (new_cwe_types_this_qtr = 0), suggesting that adversaries and researchers continue to focus exploitation and discovery on well-worn, but insufficiently mitigated, categories of weakness—further reinforcing the persistent nature of memory management vulnerabilities in modern software architecture.

Synthesizing these findings, three insights crystallize for vulnerability management and defense prioritization within Microsoft environments:

• Remote Code Execution vulnerabilities constitute an exceptionally consistent and severe risk area, as evidenced by their clustered high CVSS scores and tight IQR.
• The overwhelming concentration of exploits in CWE-416, CWE-125, and CWE-122 points to entrenched, systemic memory safety challenges that serve as recurring footholds for sophisticated attacks, particularly when accessible via network vectors.
• Although the total number of memory safety bugs fell this quarter, the intensification of CVEs within the highest-severity bands—and the rising coverage of the top CWEs—suggests adversaries continue to favor these proven paths of compromise, especially against foundational services critical for identity and endpoint security.

The quarter's data reveals a critical and predictable threat vector targeting the core of Microsoft's identity infrastructure. The predominance of high-severity Remote Code Execution (RCE) vulnerabilities, consistently clustered near CVSS 8.8 and driven by systemic memory safety flaws like CWE-416 (Use After Free), poses a direct risk to foundational services. Specifically, when these RCEs affect protocols like the Lightweight Directory Access Protocol (LDAP), they create an acute threat to the integrity of Entra ID. A successful exploit could allow an attacker to manipulate directory objects or bypass authentication controls, potentially leading to a full identity infrastructure compromise. This makes patching and monitoring network-facing services that handle authentication and directory queries the highest priority.

This depth of analysis refines the understanding of the Microsoft security landscape for the quarter. The combination of tightly clustered high CVSS scores in critical categories, and the persistent prevalence of particular memory-handling weaknesses, delineates clear prioritization hotspots. For technical and executive teams alike, the evidence underscores the acute and ongoing risk posed by remote, memory-based vulnerabilities—especially those mapped to well-known CWEs—in safeguarding the core of Microsoft's infrastructure and its identity-driven services.

The "Product Impact & Remediation Timeliness" section shifts the analytical focus towards the tangible impact of vulnerabilities on specific Microsoft products and product families, and critically examines the timeliness of the remediation and disclosure lifecycle. Understanding which products are most frequently targeted or harbor the most severe vulnerabilities is essential for resource allocation in patching and system hardening. For instance, a high concentration of critical CVEs in widely deployed server products demands immediate attention from administrators.

Equally important is the timeliness aspect. The period between a vendor releasing a patch and the vulnerability details being publicly cataloged (e.g., in the National Vulnerability Database - NVD) represents a window of potential exposure where systems might be patched but full public awareness and standardized scoring are still pending. Conversely, delays in patching vulnerabilities that are already publicly known (or worse, exploited) increase risk. This section will analyze metrics such as the median days to NVD publication and the percentage of CVEs disclosed by NVD within critical timeframes post-vendor patch.

This analysis of product impact and disclosure/patching timeliness provides system administrators and security teams with actionable intelligence for prioritizing their efforts and understanding the dynamics of the vulnerability management ecosystem for Microsoft products.

A review of vulnerability distribution this quarter reveals a complex risk landscape across Microsoft’s product ecosystem. Significantly, Windows 11 24h2 x64-based systems exhibit the highest volume of reported CVEs, making it the most affected product for the period. The "Top Affected Products by CVE Criticality" chart (Figure 11) highlights a sustained concentration of high-severity vulnerabilities—95 entries for Windows 11 24h2 x64, closely followed by Windows 11 23h2 and 22h2 x64 editions, with 94 high-severity CVEs each. These figures represent a marked lead over all Windows 10 variants, which display notably lower high-severity counts, peaking at 72 for Windows 10 21h2 x64 and descending from there. Notably, no Windows edition registered any critical CVEs for the period under review.

This absence of critical vulnerabilities in the core Windows platform is a continuing trend from previous quarters. However, the persistent and high volume of high-severity CVEs in Windows 11 x64 releases points to an ongoing, nuanced threat to the operating system’s security posture. While catastrophic flaws are rare, the sustained prevalence of high-severity exploits poses a risk of gradual degradation in OS security baselines, potentially enabling advanced attack techniques such as privilege escalation or lateral movement. The continuous concentration of vulnerabilities within the latest Windows 11 builds underlines the expanding attack surface as these editions become central to critical enterprise workflows and identity platforms.

In sharp contrast, Microsoft Edge (Chromium) is the only product to register a critical-severity CVE during this quarter, as represented in the chart and supported by the data table (“1” in Critical column). Although its count of high-severity CVEs is lower than that of the leading Windows 11 builds (21 vs. 95+), the mere presence of any critical vulnerability in a client-facing application like Edge is significant. This highlights the shifting threat focus toward endpoint browsers, which now constitute key attack vectors—especially in environments where identity, web access, and physical endpoint boundaries increasingly intersect.

Analysis of remediation and public disclosure timelines indicates marked efficiency in the vendor-to-NVD publication pipeline. The median_days_to_patch statistic for the reporting period is exactly 0.0 days, reflecting that, for the majority of vulnerabilities, the NVD published details on the same day that patches became available. This lag time is unchanged from the previous quarter (as shown by a median_days_to_patch_qoq_delta_abs of 0.0), suggesting a stable trend. Such timeliness is further reinforced by the high rates of prompt publication: 96.3% of vulnerabilities are cataloged by NVD within seven days of patch release (patched_le_7d_pct), and this rises to 98.3% within thirty days (patched_le_30d_pct). Both of these rates show quarter-over-quarter improvements, with the seven-day metric rising by approximately 2.9% and the thirty-day metric increasing by 1.7%.

The "NVD Publication Delay by CVE Severity" chart (Figure 12) provides granularity into these trends by severity. For both Medium and High severity CVEs, the median delay to public disclosure remains at zero days, reflecting efficient processing and dissemination irrespective of risk level. However, the single Critical-severity CVE—affecting Microsoft Edge (Chromium)—exhibits a publication lag of four days. This isolated longer delay does not appear to represent a systemic gap but does highlight potential episodic risk for critical vulnerabilities in non-core products. Boxplot data indicates that while most publication intervals cluster around the release date, negative outliers occasionally arise, sometimes reflecting data artifacts or early reporting by external entities rather than actual early disclosure or exploitation scenarios.

Across both product and timeliness dimensions, there is no evidence this quarter of widespread “zero-day” exploitation—defined as vulnerabilities exploited prior to or concurrent with their NVD disclosure or patch release—within the available dataset. The absence of reported exploited CVEs (as inferred from the lack of any zero_day_count or similar metrics in this release) suggests that, for this quarter, vulnerability management teams did not face emergent threats from unpatched, in-the-wild exploits at the point of initial disclosure.

From a trend perspective, quarter-over-quarter analysis demonstrates a positive, if modest, improvement in disclosure velocity. Both seven- and thirty-day NVD publication percentages have increased compared to the prior period, reinforcing progress toward rapid normalization of CVE intelligence across the ecosystem. The median publication lag remains at zero, indicating consistent adherence to best practices in transparent and immediate communication of vulnerability details by Microsoft and downstream partners.

This quarter's data reveals a critical divergence in the Microsoft threat landscape. While the core Windows platform remains free of 'critical'-rated CVEs, the high and sustained volume of 'high'-severity vulnerabilities in the latest Windows 11 x64 editions signals a risk of gradual security erosion, creating pathways for sophisticated attacks like privilege escalation. Simultaneously, the quarter's sole 'critical' CVE appeared in Microsoft Edge, cementing the browser as the new frontier for the most severe, direct threats. This dual-risk profile demands a recalibrated defensive posture: administrators must manage the systemic risk within the OS through diligent patching while also prioritizing the browser as a primary vector for critical exploits.

Implications for administrators are clear from the pattern of impact. Given the abundance of high-severity CVEs in Windows 11 x64 environments, administrators should maintain heightened vigilance for rapid application of security patches to these systems, even in the absence of critical-rated vulnerabilities. While traditional anxieties might center on critical flaws, the sheer volume and complexity of high-severity vulnerabilities established in current Windows 11 builds present an equally pressing risk—potentially contributing to attack surface erosion in ways not immediately apparent through severity scoring alone. Administrators managing browser deployments, particularly Microsoft Edge, should also be aware of its elevated profile as a target, driven by the presence of both high- and critical-severity CVEs and reflecting evolving attack patterns.

The quarter’s data paints a nuanced but overall positive picture for remediation timeliness, marked by near-immediate public disclosure of most vulnerabilities and stable or improving trends compared to prior quarters. Product impact remains heavily skewed toward Windows 11 24h2 x64, which continues to see the highest volume of high-severity vulnerabilities, despite the absence of criticals. Meanwhile, critical CVEs have shifted toward the browser layer, specifically Microsoft Edge (Chromium), emphasizing the changing contours of operational risk for organizations dependent on Microsoft’s desktop and endpoint platforms. System administrators are thus presented with a landscape demanding rapid patching cadence, targeted vigilance toward new product releases, and a continued focus on endpoint and browser security in addition to traditional operating system hardening.

The "Spotlight: This Quarter's Most Critical Vulnerabilities" section provides a focused examination of a curated list of the most critical and potentially impactful Microsoft Windows vulnerabilities disclosed during this reporting period. While previous sections have analyzed broad trends and distributions, this spotlight aims to draw specific attention to individual CVEs that warrant heightened awareness due to their inherent severity, ease of exploitation, or observed activity in the threat landscape.

The goal here is not to be exhaustive, but rather to highlight exemplars of high-risk vulnerabilities. A key part of this analysis involves identifying what we term "Worst-Case Scenario CVEs"—vulnerabilities that possess a combination of characteristics making them exceptionally dangerous. By dissecting these specific cases, organizations can gain a more concrete understanding of the types of threats that demand immediate prioritization and can use these examples to test their own detection and response capabilities. This targeted analysis serves as a practical supplement to the broader statistical picture painted earlier in the report.

The vulnerabilities highlighted in this section are selected through a rigorous methodology that combines multiple risk factors. Primary selection criteria include a high Common Vulnerability Scoring System (CVSS) v3.1 base score, direct or credible evidence of exploitation, and exploitability features that indicate broad potential impact in Microsoft environments. Notably, to align the focus with risks most relevant to Windows-centric enterprises, the curation process excludes vulnerabilities rooted primarily in the open-source Chromium project—unless a given Chromium-based CVE manifests an atypical or heightened risk distinct within the Microsoft product landscape. Further, functionally duplicate CVEs occasionally published by Microsoft are typically consolidated; only a single representative is analyzed in-depth when product sub-versioning or minor contextual differences do not materially alter the impact profile. This approach sharpens the analysis on distinct threat types and streamlines attention to the most operationally significant CVEs within core Microsoft products.

Central to this spotlight is the "Worst-Case Scenario CVEs" metric. This refers to the subset of vulnerabilities that satisfy all of the following stringent CVSS vector criteria: an Attack Vector of Network (AV:N), Low Attack Complexity (AC:L), No Privileges Required (PR:N), and No User Interaction (UI:N). CVEs that meet all four conditions are especially dangerous, being both remotely exploitable and suitable for rapid, automated attacks without prerequisites or limitations. For this quarter, nine such "Worst-Case" CVEs were identified, representing a clear and immediate threat to corporate defenses by virtue of their exploitability and attack surface.

For each selected CVE in this spotlight, the report presents core characteristics including its identifier, CVSS v3.1 base score, critical exploitability metrics, affected products, and a concise summary of the vulnerability’s potential operational impact. To establish an objective baseline for comparing the severity of these spotlighted risks, Figure 13 illustrates the CVSS base scores assigned to them. The scoring distribution for the ten highlighted vulnerabilities is notably narrow, spanning from 8.4 to 8.8, with eight of the ten registering the highest observed value in this subset (8.8). As such, all fall squarely within the high-severity category, with a marked clustering at the upper end—underscoring that the curated set consists exclusively of risks requiring elevated attention.

The following entries will now delve into the specifics of the high-priority vulnerabilities identified through the selection process described above.

Spotlight CVEs Summary Details

CVE-2025-21205 - Windows Telephony Service Remote Code Execution Vulnerability

A heap-based buffer overflow vulnerability in the Windows Telephony Service allows unauthorized attackers to execute arbitrary code over a network. This vulnerability is particularly concerning as it can be exploited remotely, requiring only that a user connects to a malicious server. While user interaction is necessary, the complexity is low, making it easier for attackers to succeed. The potential impact includes total loss of confidentiality, integrity, and availability. For remediation, administrators should ensure the following security updates are installed using standard enterprise patching tools:

• Windows 10 Version 22H2 for x64-based Systems: KB5055518
• Windows 11 Version 22H2 for x64-based Systems: KB5055528
• Windows Server 2025: KB5055523

CVE-2025-26669 - Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability

An out-of-bounds read vulnerability in Windows Routing and Remote Access Service (RRAS) could allow an unauthorized attacker to disclose sensitive information over a network. With a CVSS score of 8.8, this vulnerability poses a high risk. Attackers may exploit this by tricking users into sending requests to malicious servers, which could return harmful data leading to arbitrary code execution. Microsoft has released an official fix, and system administrators are advised to monitor for and apply the relevant security updates for all affected Windows versions, including Windows Server 2012, Windows Server 2008, and Windows 10.

CVE-2025-29840 - Windows Media Remote Code Execution Vulnerability

A stack-based buffer overflow vulnerability in Windows Media allows unauthorized remote code execution. This vulnerability (CVSS 8.8) can be exploited by an attacker convincing a user to open a specially crafted file, leading to arbitrary code execution in the context of the user. To mitigate this risk, administrators should deploy the following security updates:

• Windows 10 Version 1607: KB5058383
• Windows 10 Version 22H2: KB5058379
• Windows Server 2022: KB5058385
• Windows 11 Version 23H2: KB5058405

CVE-2025-29966 - Remote Desktop Client Remote Code Execution Vulnerability

A critical heap-based buffer overflow vulnerability (CVSS 8.8) in the Windows Remote Desktop Client allows unauthorized attackers to execute arbitrary code. This can be exploited when a victim connects to a compromised Remote Desktop Server using the vulnerable client. The attack does not require any prior privileges. System administrators are strongly advised to apply the relevant security updates to mitigate this risk:

• Windows Server 2012 R2: KB5058403
• Windows Server 2012: KB5058451
• Windows Server 2008 R2: KB5058430
• Windows 10 Version 22H2 / 21H2: KB5058379
• Windows 11 Version 22H2: KB5058405
• Windows Server 2016: KB5058383
• Windows Server 2022: KB5058385
• Remote Desktop client for Windows Desktop: KB5058392

CVE-2025-33053 - Web Distributed Authoring and Versioning (WEBDAV) Remote Code Execution Vulnerability

A remote code execution vulnerability (CVSS 8.8) exists in WebDAV due to external control of file names or paths. An attacker can exploit this over a network by tricking a user into clicking a specially crafted URL. The attack does not require any prior privileges, making it particularly dangerous. Microsoft has released an official fix, and system administrators are advised to apply the latest security patches to all supported versions of Microsoft Windows to mitigate this risk.

CVE-2025-33066 - Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

A heap-based buffer overflow vulnerability in Windows Routing and Remote Access Service (RRAS) allows unauthorized attackers to execute arbitrary code over a network. The attack vector is network-based, requiring user interaction to exploit, as the attacker must trick the user into connecting to a malicious server. This vulnerability is classified with a CVSS score of 8.8. Microsoft has released security updates, including KB5061018 for Windows Server 2012 R2, KB5061059 for Windows Server 2012, and KB5061078 for Windows Server 2008 R2, which should be deployed immediately.

CVE-2025-25000 - Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

A type confusion vulnerability in Microsoft Edge (Chromium-based) allows unauthorized attackers to execute code remotely. This vulnerability can be exploited by hosting a specially crafted website that targets Microsoft Edge. The potential impact includes high confidentiality, integrity, and availability risks. Microsoft has released an official fix, and system administrators are urged to ensure all clients are updated to version 135.0.3179.54 or later to mitigate the risk.

CVE-2025-33073 - Windows SMB Client Elevation of Privilege Vulnerability

A vulnerability in Windows SMB allows an authorized attacker to elevate privileges to SYSTEM level over a network. This issue arises from improper access control, enabling attackers with low privileges to exploit the vulnerability without requiring user interaction by convincing a victim to connect to a malicious SMB server. To mitigate this risk, administrators should:

• Apply the relevant security updates for all affected systems, including Windows Server 2016, Windows 10, and Windows Server 2022.
• Ensure that SMB signing is enabled to add an additional layer of security.
• Regularly review and restrict access to SMB shares to minimize exposure.

CVE-2025-27737 - Windows Security Zone Mapping Security Feature Bypass Vulnerability

A vulnerability exists in Windows Security Zone Mapping due to improper input validation, allowing unauthorized attackers to bypass security features locally. An attacker with local access can exploit this by having a user execute a specially crafted URL. Successful exploitation could lead to privilege escalation. To mitigate the risk, administrators should deploy the following security updates:

• Windows 10 Version 22H2 for x64-based Systems: KB5055518
• Windows Server 2022: KB5055526
• Windows 11 Version 23H2 for ARM64-based Systems: KB5055528

CVE-2025-26678 - Windows Defender Application Control Security Feature Bypass Vulnerability

A vulnerability in Windows Defender Application Control (WDAC) allows unauthorized attackers to bypass security features locally. This security feature bypass is due to improper access control, enabling attackers to execute unauthorized applications. The attack vector is local, requiring no special privileges or user interaction. To mitigate this risk, administrators should:

• Ensure Windows Defender Application Control policies are correctly configured to restrict unauthorized applications.
• Regularly update systems to the latest security patches to protect against known vulnerabilities.
• Monitor system logs for any unauthorized access attempts or anomalies related to application execution.

To complement the detailed analysis of specific CVEs, we also explore broader patterns using a visualization technique called t-distributed Stochastic Neighbor Embedding (t-SNE). This method processes complex CVE data by projecting multi-faceted characteristics into a two-dimensional map. While t-SNE is not a conventional tool for daily system administration, its application here can help reveal inherent groupings or 'profiles' among diverse vulnerabilities. By observing how these CVEs cluster, we can potentially identify underlying similarities or distinctions in their nature that might otherwise be obscured in raw data, offering another perspective on threat trends.

Figure 14 presents this t-SNE projection as applied to the quarter’s vulnerability dataset. This visualization reveals clear structural differentiation among CVE profiles based on their core characteristics. Specifically, Elevation of Privilege (EoP) vulnerabilities with a local attack vector are tightly clustered in one area, while Chromium-based CVEs leveraging network attack vectors form a distinctly separated cluster. This clear separation confirms marked underlying differences—primarily in attack vector and category. No extreme outliers are present, implying that the reported vulnerabilities cluster into a limited set of meaningful operational profiles.

This quarter's spotlight reveals two distinct and equally critical vulnerability profiles that demand a defense-in-depth strategy. First, the clear clustering of network-based Remote Code Execution (RCE) vulnerabilities, many requiring no privileges or user interaction, presents an immediate threat to the network perimeter and externally-facing services. This mandates prioritized patching and the reinforcement of network threat detection in Defender. Second, the dense cluster of local Elevation of Privilege (EoP) vulnerabilities underscores the significant risk of rapid escalation following any initial compromise. This necessitates robust internal monitoring and behavior analytics to detect and contain lateral movement before an attacker can reach critical identity components managed by Entra ID.